Authentication
Separate human sign-in from service-to-service authentication.
Choose the correct identity#
Workspace members sign in through the organization’s identity provider. Automated workloads use service identities with project-scoped grants. A service identity cannot be used to sign in to the web console.
| Identity | Credential | Scope |
|---|---|---|
| Member | Interactive SSO session | Assigned workspace roles |
| Service | Short-lived access token | Explicit project grants |
| Webhook receiver | Signing secret | A specific event subscription |
Authenticate an API request#
curl https://api.universe.example/v1/projects \
-H "Authorization: Bearer ${DU_TOKEN}" \
-H "Accept: application/json"DU_TOKEN is an example environment-variable reference, not a supplied credential. Provide tokens through your organization’s approved secret mechanism.
Handle authentication failures#
A 401 response means the token is missing, expired, or invalid. A 403 response means the identity is recognized but lacks permission. Re-authenticating does not resolve a missing permission grant.